Virtual ethernet port aggregation (VEPA)-enabled multi-tenant overlay network

BACKGROUND

p-0002The present invention relates to data center infrastructure, and more particularly, this invention relates to enabling Virtual Ethernet Port Aggregation (VEPA) in a multi-tenant overlay network.

p-0003VEPA is a mechanism that offloads checking and enabling inter virtual machine (VM) traffic (access control) from servers hosting the VMs to physical networking elements, such as switches, routers, etc., to which the servers are connected.

p-0004In an overlay network environment, traffic originating from VMs is encapsulated in a tunneled packet. Due to this constraint, physical networking elements in the overlay network may not be able to enforce client defined forwarding rules on a VM's traffic since the data needed for sanity checking is not available at standard offsets within the complete tunneled packet.

p-0005Note that in VEPA, a sender and receiver of traffic reside on the same server, but have different identification information, such as different media access control (MAC) addresses, internet protocol (IP) addresses, etc. Hence for a tunnel header, the source and destination information will represent the same server. The tunnel headers however, comprise tenant information which is used to perform access control operations. Additionally, the tunnel headers may be built as a User Datagram Protocol (UDP) over IP datagram.

p-0006Physical networking elements today do not have the ability to remove the tunnel headers while retaining tenant specific information, perform access control operations on the native virtual machine traffic, reattach the tunnel header (while modifying certain destination addressing information), and then send the packet back to the originating server. However, physical networking elements have very sophisticated access control mechanisms available to perform deep packet inspection operations at higher speeds than would be possible on servers. Accordingly, it would be beneficial to have a solution where VEPA is provided to tunneled packets in an overlay network environment.

SUMMARY

p-0007In one embodiment, a system includes a host server providing a virtual switch, the virtual switch including logic adapted for receiving a packet from a first virtual machine (VM) on a host server, logic adapted for determining that a destination of the packet is a second VM common to the host server, logic adapted for encapsulating the packet with a tunnel header to form an overlay packet, logic adapted for sending the overlay packet via a tunnel to a physical networking element to have inspection services performed thereon, logic adapted for receiving the overlay packet from the physical networking element, logic adapted for de-encapsulating the overlay packet to retrieve a serviced packet, and logic adapted for forwarding the serviced packet to the second VM, wherein the tunnel header includes tenant specific information.

p-0008In another embodiment, a method for enabling VEPA in an overlay network includes receiving a packet from a first VM on a host server, determining that a destination of the packet is a second VM common to the host server, encapsulating the packet with a tunnel header to form an overlay packet, sending the overlay packet via a tunnel to a physical networking element to have inspection services performed thereon, receiving the overlay packet from the physical networking element, de-encapsulating the overlay packet to retrieve a serviced packet, and forwarding the serviced packet to the second VM, wherein the tunnel header includes tenant specific information.

p-0009In yet another embodiment, a computer program product for enabling VEPA in an overlay network includes a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code including computer readable program code configured for receiving a packet from a first VM on a host server, computer readable program code configured for determining that a destination of the packet is a second VM common to the host server, computer readable program code configured for encapsulating the packet with a tunnel header to form an overlay packet, computer readable program code configured for sending the overlay packet via a tunnel to a physical networking element to have inspection services performed thereon, computer readable program code configured for receiving the overlay packet from the physical networking element, computer readable program code configured for de-encapsulating the overlay packet to retrieve a serviced packet, and computer readable program code configured for forwarding the serviced packet to the second VM, wherein the tunnel header includes tenant specific information.

p-0010According to another embodiment, a system includes logic adapted for receiving an overlay packet from a virtual switch via a tunnel, logic adapted for de-encapsulating the overlay packet by removing a tunnel header to retrieve an inner packet, logic adapted for determining a source and destination of the inner packet, logic adapted for performing inspection services on the inner packet based on tenant specific information included in the overlay packet, logic adapted for determining whether to send the inner packet to the destination, logic adapted for, when the determination is to send the inner packet to the destination, re-encapsulating the inner packet into the tunnel header to form the overlay packet and sending the overlay packet to the virtual switch via the tunnel, and logic adapted for, when the determination is to not send the packet to the destination, dropping the packet, wherein the tunnel header includes tenant specific information.

p-0011Other aspects and embodiments of the present invention will become apparent from the following detailed description, which, when taken in conjunction with the drawings, illustrate by way of example the principles of the invention.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

p-0012<figref idrefs="DRAWINGS">FIG. 1</figref> illustrates a network architecture, in accordance with one embodiment.

p-0013<figref idrefs="DRAWINGS">FIG. 2</figref> shows a representative hardware environment that may be associated with the servers and/or clients of <figref idrefs="DRAWINGS">FIG. 1</figref>, in accordance with one embodiment.

p-0014<figref idrefs="DRAWINGS">FIG. 3</figref> is a simplified diagram of a virtualized data center, according to one embodiment.

p-0015<figref idrefs="DRAWINGS">FIG. 4</figref> shows a portion of an overlay network environment, according to one embodiment.

p-0016<figref idrefs="DRAWINGS">FIG. 5A</figref> shows packet encapsulation, according to one embodiment.

p-0017<figref idrefs="DRAWINGS">FIG. 5B</figref> shows information exchange for packet encapsulation, according to one embodiment.

p-0018<figref idrefs="DRAWINGS">FIG. 6</figref> is a flowchart of a method, according to one embodiment.

p-0019<figref idrefs="DRAWINGS">FIG. 7</figref> is a flowchart of a method, according to one embodiment.

DETAILED DESCRIPTION

p-0020The following description is made for the purpose of illustrating the general principles of the present invention and is not meant to limit the inventive concepts claimed herein. Further, particular features described herein can be used in combination with other described features in each of the various possible combinations and permutations.

p-0021Unless otherwise specifically defined herein, all terms are to be given their broadest possible interpretation including meanings implied from the specification as well as meanings understood by those skilled in the art and/or as defined in dictionaries, treatises, etc.

p-0022It must also be noted that, as used in the specification and the appended claims, the singular forms “a,” “an,” and “the” include plural referents unless otherwise specified.

p-0023In one approach, Virtual Ethernet Port Aggregation (VEPA) is enabled in an overlay network in order to take advantage of the networking elements' ability to provide access control operations on overlay network traffic in conjunction with certain information from the tunnel headers. The native capabilities of processors, such as application specific integrated circuits (ASICs) in the physical networking elements may then be leveraged to provide higher throughput and more sophisticated packet inspection than is possible using the servers only.

p-0024In one general embodiment, a system includes a host server providing a virtual switch, the virtual switch including logic adapted for receiving a packet from a first virtual machine (VM) on a host server, logic adapted for determining that a destination of the packet is a second VM common to the host server, logic adapted for encapsulating the packet with a tunnel header to form an overlay packet, logic adapted for sending the overlay packet via a tunnel to a physical networking element to have inspection services performed thereon, logic adapted for receiving the overlay packet from the physical networking element, logic adapted for de-encapsulating the overlay packet to retrieve a serviced packet, and logic adapted for forwarding the serviced packet to the second VM, wherein the tunnel header includes tenant specific information.

p-0025In another general embodiment, a method for enabling VEPA in an overlay network includes receiving a packet from a first VM on a host server, determining that a destination of the packet is a second VM common to the host server, encapsulating the packet with a tunnel header to form an overlay packet, sending the overlay packet via a tunnel to a physical networking element to have inspection services performed thereon, receiving the overlay packet from the physical networking element, de-encapsulating the overlay packet to retrieve a serviced packet, and forwarding the serviced packet to the second VM, wherein the tunnel header includes tenant specific information.

p-0026In yet another general embodiment, a computer program product for enabling VEPA in an overlay network includes a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code including computer readable program code configured for receiving a packet from a first VM on a host server, computer readable program code configured for determining that a destination of the packet is a second VM common to the host server, computer readable program code configured for encapsulating the packet with a tunnel header to form an overlay packet, computer readable program code configured for sending the overlay packet via a tunnel to a physical networking element to have inspection services performed thereon, computer readable program code configured for receiving the overlay packet from the physical networking element, computer readable program code configured for de-encapsulating the overlay packet to retrieve a serviced packet, and computer readable program code configured for forwarding the serviced packet to the second VM, wherein the tunnel header includes tenant specific information.

p-0027According to another general embodiment, a system includes logic adapted for receiving an overlay packet from a virtual switch via a tunnel, logic adapted for de-encapsulating the overlay packet by removing a tunnel header to retrieve an inner packet, logic adapted for determining a source and destination of the inner packet, logic adapted for performing inspection services on the inner packet based on tenant specific information included in the overlay packet, logic adapted for determining whether to send the inner packet to the destination, logic adapted for, when the determination is to send the inner packet to the destination, re-encapsulating the inner packet into the tunnel header to form the overlay packet and sending the overlay packet to the virtual switch via the tunnel, and logic adapted for, when the determination is to not send the packet to the destination, dropping the packet, wherein the tunnel header includes tenant specific information.

p-0028As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as “logic,” a “circuit,” “module,” or “system.” Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.

p-0029Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a non-transitory computer readable storage medium. A non-transitory computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the non-transitory computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a portable compact disc read-only memory (CD-ROM), a Blu-Ray disc read-only memory (BD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a non-transitory computer readable storage medium may be any tangible medium that is capable of containing, or storing a program or application for use by or in connection with an instruction execution system, apparatus, or device.

p-0030A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a non-transitory computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device, such as an electrical connection having one or more wires, an optical fiber, etc.

p-0031Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

p-0032Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++, or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on a user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer or server may be connected to the user's computer through any type of network, including a local area network (LAN), storage area network (SAN), and/or a wide area network (WAN), any virtual networks, or the connection may be made to an external computer, for example through the Internet using an Internet Service Provider (ISP).

p-0033Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatuses (systems), and computer program products according to various embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

p-0034These computer program instructions may also be stored in a computer readable medium that may direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.

p-0035The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

p-0036<figref idrefs="DRAWINGS">FIG. 1</figref> illustrates a network architecture <b>100</b>, in accordance with one embodiment. As shown in <figref idrefs="DRAWINGS">FIG. 1</figref>, a plurality of remote networks <b>102</b> are provided including a first remote network <b>104</b> and a second remote network <b>106</b>. A gateway <b>101</b> may be coupled between the remote networks <b>102</b> and a proximate network <b>108</b>. In the context of the present network architecture <b>100</b>, the networks <b>104</b>, <b>106</b> may each take any form including, but not limited to a LAN, a VLAN, a WAN such as the Internet, public switched telephone network (PSTN), internal telephone network, etc.

p-0037In use, the gateway <b>101</b> serves as an entrance point from the remote networks <b>102</b> to the proximate network <b>108</b>. As such, the gateway <b>101</b> may function as a router, which is capable of directing a given packet of data that arrives at the gateway <b>101</b>, and a switch, which furnishes the actual path in and out of the gateway <b>101</b> for a given packet.

p-0038Further included is at least one data server <b>114</b> coupled to the proximate network <b>108</b>, and which is accessible from the remote networks <b>102</b> via the gateway <b>101</b>. It should be noted that the data server(s) <b>114</b> may include any type of computing device/groupware. Coupled to each data server <b>114</b> is a plurality of user devices <b>116</b>. Such user devices <b>116</b> may include a desktop computer, laptop computer, handheld computer, printer, and/or any other type of logic-containing device. It should be noted that a user device <b>111</b> may also be directly coupled to any of the networks, in some embodiments.

p-0039A peripheral <b>120</b> or series of peripherals <b>120</b>, e.g., facsimile machines, printers, scanners, hard disk drives, networked and/or local storage units or systems, etc., may be coupled to one or more of the networks <b>104</b>, <b>106</b>, <b>108</b>. It should be noted that databases and/or additional components may be utilized with, or integrated into, any type of network element coupled to the networks <b>104</b>, <b>106</b>, <b>108</b>. In the context of the present description, a network element may refer to any component of a network.

p-0040According to some approaches, methods and systems described herein may be implemented with and/or on virtual systems and/or systems which emulate one or more other systems, such as a UNIX system which emulates an IBM z/OS environment, a UNIX system which virtually hosts a MICROSOFT WINDOWS environment, a MICROSOFT WINDOWS system which emulates an IBM z/OS environment, etc. This virtualization and/or emulation may be enhanced through the use of VMWARE software, in some embodiments.

p-0041In more approaches, one or more networks <b>104</b>, <b>106</b>, <b>108</b>, may represent a cluster of systems commonly referred to as a “cloud.” In cloud computing, shared resources, such as processing power, peripherals, software, data, servers, etc., are provided to any system in the cloud in an on-demand relationship, thereby allowing access and distribution of services across many computing systems. Cloud computing typically involves an Internet connection between the systems operating in the cloud, but other techniques of connecting the systems may also be used, as known in the art.

p-0042<figref idrefs="DRAWINGS">FIG. 2</figref> shows a representative hardware environment associated with a user device <b>116</b> and/or server <b>114</b> of <figref idrefs="DRAWINGS">FIG. 1</figref>, in accordance with one embodiment. <figref idrefs="DRAWINGS">FIG. 2</figref> illustrates a typical hardware configuration of a workstation having a central processing unit (CPU) <b>210</b>, such as a microprocessor, and a number of other units interconnected via one or more buses <b>212</b> which may be of different types, such as a local bus, a parallel bus, a serial bus, etc., according to several embodiments.

p-0043The workstation shown in <figref idrefs="DRAWINGS">FIG. 2</figref> includes a Random Access Memory (RAM) <b>214</b>, Read Only Memory (ROM) <b>216</b>, an I/O adapter <b>218</b> for connecting peripheral devices such as disk storage units <b>220</b> to the one or more buses <b>212</b>, a user interface adapter <b>222</b> for connecting a keyboard <b>224</b>, a mouse <b>226</b>, a speaker <b>228</b>, a microphone <b>232</b>, and/or other user interface devices such as a touch screen, a digital camera (not shown), etc., to the one or more buses <b>212</b>, communication adapter <b>234</b> for connecting the workstation to a communication network <b>235</b> (e.g., a data processing network) and a display adapter <b>236</b> for connecting the one or more buses <b>212</b> to a display device <b>238</b>.

p-0044The workstation may have resident thereon an operating system such as the MICROSOFT WINDOWS Operating System (OS), a MAC OS, a UNIX OS, etc. It will be appreciated that a preferred embodiment may also be implemented on platforms and operating systems other than those mentioned. A preferred embodiment may be written using JAVA, XML, C, and/or C++ language, or other programming languages, along with an object oriented programming methodology. Object oriented programming (OOP), which has become increasingly used to develop complex applications, may be used.

p-0045Referring now to <figref idrefs="DRAWINGS">FIG. 3</figref>, a conceptual view of an overlay network <b>300</b> is shown according to one embodiment. In order to virtualize network services, other than simply providing a fabric path (connectivity) between devices, services may be rendered on packets as they move through the gateway <b>314</b> which provides routing and forwarding for packets moving between the non-virtual network(s) <b>312</b> and the Virtual Network A <b>304</b> and Virtual Network B <b>306</b>. The one or more virtual networks <b>304</b>, <b>306</b> exist within a physical (real) network infrastructure <b>302</b>. The network infrastructure <b>302</b> may include any components, hardware, software, and/or functionality typically associated with and/or used in a network infrastructure, including, but not limited to, switches, connectors, wires, circuits, cables, servers, hosts, storage media, operating systems, applications, ports, I/O, etc., as would be known by one of skill in the art. This network infrastructure <b>302</b> supports at least one non-virtual network <b>312</b>, which may be a legacy network.

p-0046Each virtual network <b>304</b>, <b>306</b> may use any number of virtual machines (VMs) <b>308</b>, <b>310</b>. In one embodiment, Virtual Network A <b>304</b> includes one or more VMs <b>308</b>, and Virtual Network B <b>306</b> includes one or more VMs <b>310</b>. As shown in <figref idrefs="DRAWINGS">FIG. 3</figref>, the VMs <b>308</b>, <b>310</b> are not shared by the virtual networks <b>304</b>, <b>306</b>, but instead are exclusively included in only one virtual network <b>304</b>, <b>306</b> at any given time.

p-0047According to one embodiment, the overlay network <b>300</b> may include one or more cell switched domain scalable fabric components (SFCs) interconnected with one or more distributed line cards (DLCs).

p-0048By having a “flat switch” architecture, the plurality of VMs may move data across the architecture easily and efficiently. It is very difficult for VMs, generally, to move across layer 3-domains, between one subnet to another subnet, internet protocol (IP) subnet to IP subnet, etc. But if it the architecture is similar to a large flat switch, in a very large layer 2-domain, then the VMs are aided in their attempt to move data across the architecture.

p-0049Now referring to <figref idrefs="DRAWINGS">FIG. 4</figref>, a portion of an overlay network environment <b>400</b> is shown, according to one embodiment, in order to explain how VEPA may be enabled in the overlay networking environment <b>400</b>. In this overlay network environment <b>400</b>, a physical switch <b>402</b>, a virtual switch <b>410</b> on a host server <b>404</b>, and two VMs (a source VM <b>406</b> and a destination VM <b>408</b>) are shown. The virtual switch <b>410</b> resides within a hypervisor <b>420</b> resident on the host server <b>404</b>. Of course, the overlay network environment <b>400</b> may include more components, relationships, functionality, and/or complexity than that shown in <figref idrefs="DRAWINGS">FIG. 4</figref>, as would be understood by one of skill in the art.

p-0050As shown, traffic <b>412</b> (which comprises an original packet) from any source VM <b>406</b> ingresses at a virtual switch <b>410</b> resident on a host server <b>404</b>. Even though only one packet is described herein, any of the traffic described herein may comprise multiple packets, of any type known in the art, such as IP packets, overlay packets, etc.

p-0051This traffic <b>412</b> is destined for the destination VM <b>408</b>, but when VEPA is enabled in the overlay networking environment <b>400</b>, instead of being directed to the destination VM <b>408</b> by the virtual switch <b>410</b>, it is instead routed through the physical networking element <b>402</b>. This is to allow the physical networking element <b>402</b> to perform certain sanity checks, inspection services, etc., on the traffic <b>412</b> instead of relying on the virtual switch <b>410</b> to perform these functions. Typically, the physical networking element <b>402</b> is better equipped to handle this functionality faster and more efficiently than the virtual switch <b>410</b>.

p-0052The virtual switch <b>410</b> encapsulates the original packet received from the source VM <b>406</b> into a tunnel and adds tenant specific information into certain fields in the tunnel header, as described in more detail in regard to <figref idrefs="DRAWINGS">FIGS. 5A-5B</figref>. Referring again to <figref idrefs="DRAWINGS">FIG. 4</figref>, this tunneled packet is then forwarded out of a physical network interface of the host server <b>404</b> to the physical networking element <b>402</b>, such as a switch, router, gateway device, etc. Since VEPA is enabled in the overlay network environment <b>400</b>, the source and destination of the tunneled packet are the same, as the address is the host server <b>404</b>; however, the traffic <b>412</b> received from the source VM <b>406</b>, according to embodiments described herein, may be sanitized and/or have other services performed thereon by the physical networking element <b>402</b> to which the host server <b>404</b> is connected.

p-0053Accordingly, when the traffic <b>418</b> (comprising an overlay packet encapsulating the original packet) from the host server <b>404</b> ingresses the physical networking element <b>402</b>, ingress logic of the physical networking element <b>402</b> strips the tunnel headers from the overlay packet while retaining tunnel specific and server location information, as described in more detail in <figref idrefs="DRAWINGS">FIGS. 5A-5B</figref>.

p-0054Referring again to <figref idrefs="DRAWINGS">FIG. 4</figref>, the original packet sent by the source VM <b>406</b> along with the information specifying the VM's tenancy is forwarded to packet inspection logic of the physical networking element <b>402</b>. This component of the physical networking element <b>402</b> is adapted for using the tenant specific information along with various fields in the original packet to perform packet inspection and/or sanity tests, among other possible services, in various embodiments.

p-0055Once the original packet has been verified as being safe to send to the destination VM <b>408</b>, as intended by the source VM <b>406</b>, the original packet is then re-encapsulated into a tunnel, and the tunnel headers are repopulated with the tenant information and destination information in the physical networking element <b>402</b>. This traffic <b>416</b> (including the tunneled packet) is then forwarded back to the host server <b>404</b> to be received by the virtual switch <b>410</b>. When the tunneled packet is received at the virtual switch <b>410</b>, assuming that the tunnel headers have enough tenant and destination identifying information, the virtual switch <b>410</b> removes the tunnel headers and forwards the un-encapsulated packet to the destination VM <b>408</b> as traffic <b>414</b>. Accordingly, traffic <b>414</b> destined for the destination VM <b>408</b> egresses from the virtual switch <b>410</b> after being received therein and having tunnel headers and associated information de-encapsulated from the original packet.

p-0056In this way, multi-tenancy may be supported in the overlay network environment <b>400</b>, while still having VEPA enabled in the environment. This allows for ASICs or other hardware elements in the physical networking element <b>402</b> to perform services, application of access control lists (ACLs) or any other desired functionality to a packet sent from one VM to another VM within the overlay network.

p-0057Now referring to <figref idrefs="DRAWINGS">FIG. 5A</figref>, packet encapsulation <b>500</b> is shown according to one embodiment. The packet encapsulation <b>500</b> includes outer and inner portions, where the inner packet is the original packet (Ethernet packet <b>502</b> produced by/received from the source VM), and the outer headers relate to the overlay encapsulation. As shown, the tunnel (overlay) header <b>514</b> comprises an outer media access control (MAC) header <b>506</b>, an outer IP header <b>508</b>, and outer user datagram protocol (UDP) header <b>510</b>, and tenant specific information <b>512</b>. The outer cyclic redundancy check (CRC) <b>504</b> may be added as known in the art.

p-0058In this encapsulation <b>500</b>, tenant specific information <b>512</b> may be added to the tunnel (overlay) header <b>514</b>, and some tenant specific information may also be included in the outer UDP header <b>510</b>, as allowed by the particular overlay network environment being used. In one embodiment, Virtual eXtensible Local Area Network (VXLAN) or a modified version of VXLAN may be used. Of course, any other overlay network technology, protocol, and/or devices may be used as known in the art.

p-0059As shown in <figref idrefs="DRAWINGS">FIGS. 5A-5B</figref>, a packet inspection block <b>514</b> or module of the physical networking element <b>402</b> may receive information from a received overlay packet, such as tenant specific information <b>516</b> from the outer UDP header <b>510</b>, tenant specific information <b>512</b>, and certain fields <b>518</b> from the source VM's Ethernet packet <b>502</b>, etc. This information may be used by the packet inspection block <b>514</b> to determine how to respond to the receipt of the overlay packet.

p-0060In one approach, if the inspection block <b>514</b> determines that the packet is acceptable to be forwarded to its intended destination (the destination VM), then the tunnel headers are reattached <b>522</b>, and the encapsulated packet is forwarded <b>524</b> to the host server for receipt by the virtual switch (and subsequent forwarding to the destination VM).

p-0061According to another approach, if the inspection block <b>514</b> determines that the packet is not acceptable to be forwarded to its intended destination (the destination VM), then the packet is dropped <b>520</b>.

p-0062In one approach, the inner packet may be analyzed to determine one or more services to perform on the inner packet. For example, in one embodiment where certain services are performed only on a subset of network traffic (such as for a specific tenant only, for a specific destination only, for a specific source only, etc.), a packet requiring those services must be identified as requiring those services in order to receive the service of interest. Accordingly, at least part of the determination of whether the packet should be forwarded to the destination involves a determination of whether and which services are to be performed, in one embodiment.

p-0063According to various embodiments, services that may be performed on a packet include, but are not limited to firewall services, intrusion prevention system (IPS) services, intrusion detection system (IDS), IPS/IDS services, server load balancing services, LAN optimization services, VPN services, video optimization services, network address translation (NAT) services, encryption services, decryption services, application of access control lists (ACLs), etc., among many other possibilities, as would be known to one of skill in the art.

p-0064In one embodiment, a tunnel header (such as a VXLAN frame format) may be as follows:

p-0065<tables id="TABLE-US-00001" num="00001"><table frame="none" colsep="0" rowsep="0" pgwide="1"><tgroup align="left" colsep="0" rowsep="0" cols="1"><colspec colname="1" colwidth="350pt" align="left" /><thead><row><entry namest="1" nameend="1" align="center" rowsep="1" /></row></thead><tbody valign="top"><row><entry><chemistry id="CHEM-US-00001" num="00001"><img id="EMI-C00001" he="183.64mm" wi="108.63mm" file="US08908691-20141209-C00001.TIF" alt="embedded image" img-content="table" img-format="tif" orientation="portrait" inline="no" /><attachments><attachment idref="CHEM-US-00001" attachment-type="cdx" file="US08908691-20141209-C00001.CDX" /><attachment idref="CHEM-US-00001" attachment-type="mol" file="US08908691-20141209-C00001.MOL" /></attachments></chemistry></entry></row><row><entry namest="1" nameend="1" align="center" rowsep="1" /></row></tbody></tgroup></table></tables>

p-0066This frame format may be used for determining if a packet should be inspected for an inner packet in a number of different ways. In one such way, the destination port (Dest Port) may be determined. In the frame format shown above, as an example, the destination port is a VXLAN Port, which indicates that the packet has a tunnel header. Accordingly, this packet may be un-encapsulated in order to determine what the inner packet comprises, and then whether services should be performed on the inner packet. Of course, other ways of determining whether services should be performed on an inner packet, and if a packet comprises an inner packet may be used, as known to those of skill in the art and described herein.

p-0067Now referring to <figref idrefs="DRAWINGS">FIG. 6</figref>, a flowchart of a method <b>600</b> is shown, according to one embodiment. The method <b>600</b> may be performed in accordance with the present invention in any of the environments depicted in <figref idrefs="DRAWINGS">FIGS. 1-5</figref>, among others, in various embodiments. Of course, more or less operations than those specifically described in <figref idrefs="DRAWINGS">FIG. 6</figref> may be included in method <b>600</b>, as would be understood by one of skill in the art upon reading the present descriptions.

p-0068Each of the steps of the method <b>600</b> may be performed by any suitable component of the operating environment. For example, in one embodiment, the method <b>600</b> may be partially or entirely performed by a physical networking element (such as a switch, a router, a gateway, etc.), a processor (such as a CPU, an ASIC, an FPGA, etc.), in various approaches.

p-0069As shown in <figref idrefs="DRAWINGS">FIG. 6</figref>, method <b>600</b> may initiate with operation <b>602</b>, where an overlay packet is received via a tunnel from a virtual switch on a host server.

p-0070In operation <b>604</b>, the overlay packet is de-encapsulated to retrieve an inner packet and tenant specific information. Of course, the packet must first be an overlay packet for de-encapsulation to take place, and so it may be determined that it is an overlay packet. This may be accomplished by determining a destination port of the outer UDP header. If the destination port is a virtual LAN port, such as a VXLAN port, then it may be assumed that the packet includes a tunnel header.

p-0071The inner packet may be of any type known in the art, such as I/O packets (e.g., Fiber Channel over Ethernet (FCoE) packets), control packets, IP packets, voice packets, etc.

p-0072In operation <b>606</b>, a source and a destination of the inner packet is determined. This information may be used in order to determine whether it is appropriate to forward the packet to its intended destination or not, along with what, if any services, to perform on the inner packet.

p-0073In operation <b>608</b>, inspection services are performed on the inner packet, as determined by the tenant specific information included in the headers of the overlay packet, the destination, the source, and any other useful information included in the inner packet or the tunnel headers.

p-0074In operation <b>610</b>, it is determined whether the inner packet should be forwarded to its intended destination. For example, if the packet is sent from Tenant A, and is destined for Tenant B, and there is no sharing among these tenants, then the packet should not be forwarded. In another example, if the destination shares a tenant with the source, then the packet may be sent to this destination. Of course, many other possible scenarios may exist, and the embodiments described herein are not meant to be limited to only tenant specific forwarding decisions.

p-0075If, in operation <b>610</b> it is determined to forward the inner packet to the destination, then in operation <b>614</b>, the inner packet is re-encapsulated into an overlay packet, which may be the same overlay packet in which the inner packet was received. Then, in operation <b>616</b>, the overlay packet is forwarded to the virtual switch on the host server, presumably to be forwarded on to its intended destination.

p-0076According to some further embodiments, the tenant specific information may include a virtual network identifier (VNID), at least some of the tenant specific information may be included in a UDP header, at least some of the tenant specific information may be included in a frame of the tunnel header designed to store tenant specific information, and/or the overlay network may adhere to VXLAN.

p-0077The method <b>600</b> may be performed, in various embodiments comprising all or some of the operations described in <figref idrefs="DRAWINGS">FIG. 6</figref> in computer program products, other methods, logic, and/or systems.

p-0078In one such embodiment, a system may include logic adapted for receiving an overlay packet from a virtual switch via a tunnel, logic adapted for de-encapsulating the overlay packet by removing a tunnel header to retrieve an inner packet, logic adapted for determining a source and destination of the inner packet, logic adapted for performing inspection services on the inner packet based on tenant specific information included in the overlay packet, logic adapted for determining whether to send the inner packet to the destination, logic adapted for, when the determination is to send the inner packet to the destination, re-encapsulating the inner packet into the tunnel header to form the overlay packet and sending the overlay packet to the virtual switch via the tunnel, and logic adapted for, when the determination is to not send the packet to the destination, dropping the packet. The tunnel header may include tenant specific information.

p-0079Now referring to <figref idrefs="DRAWINGS">FIG. 7</figref>, a flowchart of a method <b>700</b> is shown, according to one embodiment. The method <b>700</b> may be performed in accordance with the present invention in any of the environments depicted in <figref idrefs="DRAWINGS">FIGS. 1-5</figref>, among others, in various embodiments. Of course, more or less operations than those specifically described in <figref idrefs="DRAWINGS">FIG. 7</figref> may be included in method <b>700</b>, as would be understood by one of skill in the art upon reading the present descriptions.

p-0080Each of the steps of the method <b>700</b> may be performed by any suitable component of the operating environment. For example, in one embodiment, the method <b>700</b> may be partially or entirely performed by a virtual switch on a host server, a processor (such as a CPU, an ASIC, an FPGA, etc.), in various approaches.

p-0081As shown in <figref idrefs="DRAWINGS">FIG. 7</figref>, method <b>700</b> may initiate with operation <b>702</b>, where a packet is received from a first VM on a host server. In one approach, the packet is received by a virtual switch on the host server.

p-0082The packet may be of any type known in the art, such as I/O packets (e.g., Fiber Channel over Ethernet (FCoE) packets), control packets, IP packets, voice packets, etc.

p-0083In operation <b>704</b>, it is determined that a destination of the packet is on a second VM common to the host server, e.g., it may be forwarded to the second VM without being sent to any physical networking elements.

p-0084In optional operation <b>706</b>, it is determined that inspection services are to be performed on the packet, such as because of a destination address, a type of packet, a size of the packet, or any other criteria known in the art. In this case, it may be determined that VEPA should be used to have these services performed by a physical networking element.

p-0085In operation <b>708</b>, the packet is encapsulated with a tunnel header to form an overlay packet, as described in more detail in <figref idrefs="DRAWINGS">FIGS. 5A-5B</figref>, in one approach.

p-0086In operation <b>710</b>, the overlay packet is sent, via a tunnel, to the physical networking element to have inspection services performed thereon. Which services are to be performed may be stipulated, or the physical networking element may make this decision.

p-0087Presumably the physical networking element performs inspection services on the packet, as determined by the tenant specific information included in the headers of the overlay packet, the destination, the source, and any other useful information included in the packet or the tunnel header.

p-0088In operation <b>712</b>, the overlay packet is received back from the physical networking element, and is de-encapsulated to retrieve a serviced packet in operation <b>714</b>. Then, in operation <b>716</b>, the serviced packet is forwarded to the second VM.

p-0089The method <b>700</b> may be performed, in various embodiments comprising all or some of the operations described in <figref idrefs="DRAWINGS">FIG. 7</figref> in computer program products, other methods, logic, and/or systems.

p-0090In one such embodiment, a computer program product for enabling VEPA in an overlay network comprises a computer readable storage medium having computer readable program code embodied therewith. The computer readable program code comprises computer readable program code configured for receiving a packet from a first VM on a host server, computer readable program code configured for determining that a destination of the packet is a second VM common to the host server, computer readable program code configured for encapsulating the packet with a tunnel header to form an overlay packet, computer readable program code configured for sending the overlay packet via a tunnel to a physical networking element to have inspection services performed thereon, computer readable program code configured for receiving the overlay packet from the physical networking element, computer readable program code configured for de-encapsulating the overlay packet to retrieve a serviced packet, and computer readable program code configured for forwarding the serviced packet to the second VM, wherein the tunnel header comprises tenant specific information.

p-0091In some further embodiments, the tenant specific information may include a VNID or some other suitable tenant identifying information, at least some of the tenant specific information is included in a UDP header, at least some of the tenant specific information is included in a frame of the tunnel header designed to store tenant specific information, and/or the overlay network adheres to VXLAN.

p-0092While various embodiments have been described above, it should be understood that they have been presented by way of example only, and not limitation. Thus, the breadth and scope of an embodiment of the present invention should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.